PT-2018-13003 · Cisco · Cisco Ios Xe

Published 2018-09-26 · Updated 2019-10-09 · CVE-2018-15371

Positive Technologies (AI Summary)

CVSS v2.0

7.2

High

Base vector

AV:L/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Cisco IOS XE Software (affected versions not specified)

Description A vulnerability in the shell access request mechanism could allow an authenticated, local attacker to bypass authentication and gain unrestricted access to the root shell of an affected device. The issue exists due to insufficient authentication mechanisms for certain commands. An attacker could exploit this by requesting access to the root shell after the shell access feature has been enabled, potentially gaining unrestricted access.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Access Control

Improper Authentication

Weakness Enumeration

CWE-284

CWE-287

Related Identifiers

CVE-2018-15371

Affected Products

Cisco Ios Xe

References · 3

• https://osv.dev/vulnerability/CVE-2018-15371 · Vendor Advisory
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180926-shell-access · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-15371 · Security Note